Drupal Webform Authorization and Injection Flaws

Server-side template injection in Drupal Webform (CWE-1336) allows code injection, with the independently assessed impact rated high for confidentiality, integrity, and availability. The independent assessment identifies Webform 0.0.0 through 6.2.11 and 6.3.0 as affected, with vendor-fixed releases 6.2.12 and 6.3.1. No public exploit was identified at the time of analysis and EPSS is low at 0.22%, but the vuln.today decision is act_now because of the high severity.

Unauthenticated resource exhaustion in the Drupal Webform contrib module (all versions from 0.0.0 through 6.2.12, plus 6.3.0 through 6.3.1) lets remote attackers drive excessive resource allocation and degrade or deny availability of a Drupal site; confidentiality and integrity are unaffected (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). The flaw is CWE-770 (allocation without limits or throttling), and the vendor's stated remediation is to update the module per Drupal security advisory sa-contrib-2026-170. Risk signals are moderate rather than urgent: EPSS is 0.19% (8th percentile), there is no CISA KEV listing, and no public exploit has been identified at time of analysis, though the priority label places remediation in the current week.

Forceful browsing in the Drupal contributed Webform module lets a low-privileged authenticated user reach webform resources that are not protected by sufficiently granular access checks, yielding partial confidentiality and integrity impact with no availability effect. The flaw affects Webform releases from 0.0.0 through 6.2.12 and 6.3.0 through 6.3.1 (EUVD narrows the ranges to before 6.2.12 and before 6.3.1), and is scored 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N) per the vendor/NVD vector. Exploitation requires a valid low-privileged account on the target site, no user interaction, and network reachability; EPSS is low at 0.20% (9th percentile), there is no CISA KEV listing, and no public exploit code was identified at time of analysis, with priority classified as this_month.

Server-side request forgery in the Drupal Webform contributed module (versions 0.0.0 through 6.2.12 and 6.3.0 through 6.3.1) lets a user who holds a low-privileged authenticated account on the Drupal site cause the module to issue requests from the server, with limited confidentiality and integrity impact. Exploitation requires a valid account (CVSS PR:L) but no user interaction and no special complexity, so the practical barrier is simply having a foothold login on the site. The vendor has released a patch per the Drupal advisory, EPSS is low at roughly 0.20% (9th percentile), and no public exploit has been identified at time of analysis; the priority is a routine this-month remediation rather than an emergency response.

Stored cross-site scripting in the Drupal Webform contributed module allows an authenticated user holding a Webform-related permission to persist content that Webform later renders to other users, so a reviewer or administrator viewing that content may have script execute in their session. The flaw is a CWE-267 'privilege defined with unsafe actions' problem - a role is granted a capability whose resulting actions are not safely constrained - and it affects Webform 0.0.0 through 6.2.12 and 6.3.0 through 6.3.1, with sites on the fixed releases not exposed. Severity is moderate (CVSS 5.4; the independent assessment raises scope to changed, S:C) with a low EPSS of 0.18% (7th percentile), no CISA KEV listing, and no public exploit identified at time of analysis; the vendor reports a patch is available and the priority decision is this_month. Authentication requirements are confirmed from the CVSS vector (PR:L, low-privileged authenticated), and because the payload is stored, a second victim user must subsequently view the affected content for execution.

Unauthenticated remote attackers can bypass access controls in the Drupal Webform contributed module to read data that should be restricted, affecting versions 0.0.0 through 6.2.12 and 6.3.0 through 6.3.1. Rated CVSS 5.3 with low confidentiality impact only, the flaw cannot modify or delete content and does not affect availability, so exposure is limited to unauthorized disclosure via direct requests to access-controlled Webform resources. No public exploit code or active exploitation is confirmed at time of analysis, and EPSS sits at 0.20% (9th percentile), consistent with a moderate rather than urgent patching priority.

Functionality misuse in the Drupal Webform contributed module (versions 0.0.0 through 6.2.12 and 6.3.0 through 6.3.1) lets remote, unauthenticated attackers circumvent interaction-frequency controls such as submission or rate limits on affected forms. The assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, score 5.3) limits impact to low integrity misuse with no confidentiality or availability effect, and exploitation requires that a deployed site actually use the affected frequency-control feature; the precise trigger is not described in the available sources. No public exploit is identified at time of analysis, EPSS is 0.15% (4th percentile), the vuln.today priority label is this_month, and a vendor patch is available.

Unauthenticated remote attackers can bypass authorization checks in the Drupal Webform contributed module and reach resources they are not entitled to via forceful browsing, with the impact confined to limited confidentiality exposure (C:L; no integrity or availability effect). Sites are affected if they run Webform releases inside the ranges listed by the vendor and EUVD (0.0.0 through 6.2.12, and 6.3.0 through 6.3.1); the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N puts the score at 5.3, meaning no credentials or user interaction are needed against a default install. Exploitation pressure is currently low - EPSS 0.20 percent (9th percentile), no CISA KEV entry, and no public exploit identified at time of analysis - and a vendor patch is available, so this is a moderate-severity information-exposure issue to schedule rather than an emergency.

Cross-site scripting in the Drupal Webform contributed module lets an authenticated low-privilege user supply input that Webform renders into a generated page without neutralization, so the payload executes in the browser of any user who later loads that page, scoped to the victim's own session (CVSS 3.1 base 4.6, S:U, C:L/I:L/A:N). Drupal sites running Webform before 6.2.12, or 6.3.0 before 6.3.1, are affected; exploitation requires a low-privileged account (PR:L) plus victim interaction (UI:R), which are the principal limiters on real-world exploitability. EPSS is 0.20% (10th percentile), no public exploit identified at time of analysis, no CISA KEV entry, and a vendor patch is available, so the vuln.today decision label is this_month.

Stored cross-site scripting in the Drupal contributed Webform module (versions 0.0.0 through 6.2.12 and 6.3.0 through 6.3.1) allows an authenticated user who can submit or configure webform content to persist malicious markup that executes in the browser of another user who later views it. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N), exploitation needs a low-privileged Drupal account plus a victim - typically an administrator or form reviewer - opening the stored content, so impact is limited to the victim's session context in the affected site. Severity is medium (vendor CVSS 4.6), EPSS is 0.17% (6th percentile), no public exploit was identified at time of analysis, and a vendor patch is available per Drupal security advisory SA-CONTRIB-2026-172, placing remediation in a this-month window rather than an emergency response.

Cross-site scripting in Drupal Webform allows a low-privileged authenticated user to place unneutralized input that executes in another user's browser when the affected content is rendered. The published affected ranges cover Webform 0.0.0 to 6.2.12 and 6.3.0 to 6.3.1, with CVSS 4.6 (PR:L/UI:R) limiting impact to the victim's browser context; 6.2.12 and 6.3.1+ are treated as not affected in the independent assessment, so the boundary should be confirmed against the vendor advisory. No public exploit is identified at time of analysis, EPSS is 0.17%, CISA KEV does not list it, and the priority is moderate rather than emergency.

Stored cross-site scripting in the Drupal Webform contributed module lets an authenticated user who holds Webform authoring privileges (creating or editing webforms, elements, or related configuration) embed a persistent script payload that executes when a higher-trust user, such as a site administrator, views the affected page. The flaw is a CWE-267 privilege-definition problem: a role is permitted an unsafe action it should not be, and exploitation additionally requires victim user interaction (CVSS:3.1/AV:N/AC:L/PR:L/UI:R), with impact limited to Low confidentiality and integrity and no availability effect. Affected releases are Webform 0.0.0 through 6.2.12 and 6.3.0 through 6.3.1; EPSS is 0.19% (8th percentile), there is no CISA KEV listing, and the vendor has released a patch, so this rates as a moderate-priority issue rather than an emergency.

Cross-site scripting in the Drupal Webform contributed module allows an authenticated low-privileged user to inject script that runs when another user interacts with the generated page, affecting Webform releases below 6.2.12 in the 6.2.x branch and below 6.3.1 in the 6.3.x branch. The provided data shows no public exploit identified at time of analysis, EPSS at 0.21% (10th percentile), and no confirmed CISA KEV listing; exploitation requires a victim to interact with the malicious page.

Stored cross-site scripting in the Drupal Webform contrib module (versions 0.0.0 through 6.2.11 and 6.3.0) lets a low-privilege authenticated user inject HTML that Drupal Webform later renders without neutralization. The payload only executes when a separate victim loads the affected page, so impact is limited to the victim's browser session with unchanged scope and no availability effect; CVSS is 4.6 and EPSS is low at 0.20% (10th percentile). No public exploit code or active exploitation is confirmed, and vendor patches are available in 6.2.12 and 6.3.1.

An incorrect authorization check in the Drupal Webform module (versions 0.0.0 through 6.2.12 and 6.3.0 through 6.3.1) lets an authenticated low-privilege user reach a Webform resource by requesting its URL directly, bypassing intended access control and exposing limited confidential data. Only sites running the vulnerable module are affected; the CVSS score is 4.3 with confidentiality-only impact and no integrity or availability effect. There is no public exploit identified at time of analysis, EPSS is low at 0.18% (7th percentile), and the vendor has released fixed versions. This is a moderate-severity information-exposure issue, not an emergency.

Cross-site scripting in the Drupal Webform contrib module allows injected markup to execute in a victim's browser session when a crafted form or submission view is loaded, with impact bounded to low confidentiality and low integrity and no availability effect. Sites running Webform releases from 0.0.0 through 6.2.12 or from 6.3.0 through 6.3.1 are affected; deployments already on a fixed release are not exposed. Exploitation requires victim interaction and the vendor vector rates attack complexity high, no public exploit has been identified at time of analysis, EPSS is only 0.17% (5th percentile), and CISA KEV does not list the issue; a vendor patch is available and the aggregate priority is this_month rather than act-now.

Script injection in the Drupal Webform contributed module (versions 0.0.0 through 6.2.12 and 6.3.0 through 6.3.1) lets an actor who already holds high Webform privileges place malicious script that executes in another user's browser when that user interacts with the affected page. The injection point is a webform element or configuration setting that the available sources do not identify, and successful exploitation requires both the elevated privilege and victim interaction, keeping confidentiality and integrity impact low and scope unchanged. This is a low-severity issue: EPSS is 0.17% (6th percentile), it is not in CISA KEV, no public exploit code is confirmed, and the vendor has published a patch; the current priority decision is monitor.

Incorrect authorization in Drupal Webform allows forceful browsing; all signals point to low real-world priority. Affected releases are the supplied 0.0.0-6.2.12 and 6.3.0-6.3.1 ranges, with the independent assessment identifying 6.2.12 and 6.3.1+ as not affected, and successful exploitation is limited to low confidentiality and integrity impact. No public exploit was identified at time of analysis, EPSS is 0.18% (7th percentile), and the vendor patch is available; the supplied vendor vector requires high privileges and high attack complexity, while the independent reassessment lowers those requirements to low privileges and low complexity.

Drupal's Webform contributed module can retain sensitive submitted form data in the browser cache, leaving it recoverable by a later user of the same browser profile on versions prior to 6.2.12 and 6.3.1. Exploitation requires a low-privileged authenticated user (PR:L) to reach Webform-rendered content whose access-control and cache-control settings are misconfigured, and the assessed vector rates attack complexity as high with only limited confidentiality impact (CVSS 3.1 base score 3.1). There is no CISA KEV listing and no public exploit identified at time of analysis; EPSS is 0.19% (8th percentile) and the vuln.today priority is monitor, consistent with a low-severity, low-urgency disclosure.

Privilege Defined With Unsafe Actions vulnerability in Drupal Webform allows Stored XSS. This issue affects Webform versions: from 0.0.0 to 6.2.12, from 6.3.0 to 6.3.1.